CVE-2016-6446

A vulnerability was found in D-Link DIR-868L 2.01b05 in the strcpy function of the file /webfa_authentication.cgi in the Authentication Handler component. Manipulating the id/password arguments leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been publicly disclosed.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The saveWatermark() function copies an uploaded file to a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, content check, or filename sanitization. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The updateOSGallery() function, reached via task=update_osgallery, reads a JSON request body and calls the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check. Any function name compatible with a single argument is directly reachable, including system, exec, shell_exec, and passthru.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an unauthenticated SQL injection vulnerability was found. The showSearchResult() and showSearchResultAjax() functions read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and only strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login, and the search module is public.

An unauthenticated Remote Code Execution vulnerability was found in REDCap 13.3.0 and higher in the survey passthrough routing and Data Import processing logic. An attacker can manipulate HTTP requests to access an unintended controller route from a public survey context and supply a crafted file-path/stream parameter during import handling. Exploitation requires knowledge of a valid public survey hash.

A stack-based buffer overflow vulnerability was found in Comfast CF-N1-S 2.6.0.1 in the get_css_path_from_uri function of /cgi-bin/mbox-config in the Web Management Interface. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be used.

Use-after-free vulnerability in Suricata before 8.0.7 occurs in the Http2ThreadMultiBuf mechanism when a transaction is inspected by rules using http.response_header with and without a transform.

In Suricata before 8.0.7, a type confusion in DoH2 can cause an invalid free because cleanup code for HTTP2 state runs even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is default in 8.x versions.

Vulnerability in D-Link R95 (BE9500_1.00.16) affects the system function in /bin/ssi of the DHMAPI component. Manipulation of the NTPServer argument results in OS command injection. The attack can be executed remotely, and the exploit is public.

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.